# tcpdump -i mullvad
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on mullvad, link-type RAW (Raw IP), snapshot length 262144 bytes
15:26:01.904094 IP penygader.49524 > kolabnow.com.https: Flags [S], seq 1722299121, win 65520, options [mss 1260,sackOK,TS val 1736116169 ecr 0,nop,wscale 7], length 0
15:26:01.937688 IP kolabnow.com.https > penygader.49524: Flags [S.], seq 1954783574, ack 1722299122, win 64240, options [mss 1340,nop,nop,sackOK,nop,wscale 7], length 0
15:26:02.104493 IP penygader.54126 > kolabnow.com.https: Flags [S], seq 1411843678, win 65520, options [mss 1260,sackOK,TS val 3195388376 ecr 0,nop,wscale 7], length 0
15:26:02.133932 IP kolabnow.com.https > penygader.54126: Flags [S.], seq 2178859904, ack 1411843679, win 64240, options [mss 1340,nop,nop,sackOK,nop,wscale 7], length 0

ok, I've found something odd. Apparently you can use 10.64.0.1 as a gateway inside the mullvad tunnel, so I setup a static route for this address:

10.64.0.1 dev mullvad proto static scope link metric 128 

Which I then ping'ed

# ping 10.64.0.1
PING 10.64.0.1 (10.64.0.1) 56(84) bytes of data.
^C
--- 10.64.0.1 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4111ms

Looking at tcp dump, this time I'm getting responses:

# tcpdump -i mullvad
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on mullvad, link-type RAW (Raw IP), snapshot length 262144 bytes
15:45:31.453827 IP penygader > 10.64.0.1: ICMP echo request, id 18, seq 1, length 64
15:45:31.481398 IP 10.64.0.1 > penygader: ICMP echo reply, id 18, seq 1, length 64
15:45:32.492560 IP penygader > 10.64.0.1: ICMP echo request, id 18, seq 2, length 64
15:45:32.519818 IP 10.64.0.1 > penygader: ICMP echo reply, id 18, seq 2, length 64
15:45:33.516554 IP penygader > 10.64.0.1: ICMP echo request, id 18, seq 3, length 64
15:45:33.543803 IP 10.64.0.1 > penygader: ICMP echo reply, id 18, seq 3, length 64
15:45:34.540552 IP penygader > 10.64.0.1: ICMP echo request, id 18, seq 4, length 64
15:45:34.567838 IP 10.64.0.1 > penygader: ICMP echo reply, id 18, seq 4, length 64
15:45:35.564545 IP penygader > 10.64.0.1: ICMP echo request, id 18, seq 5, length 64
15:45:35.591841 IP 10.64.0.1 > penygader: ICMP echo reply, id 18, seq 5, length 64